# What is a risk register and how to use one > Source: https://lscs.io/learn/grc/what-is-a-risk-register/ > What belongs in a cyber risk register, how to write a risk statement properly, and how to keep a register that drives decisions rather than collecting dust. The risk register is the central artefact of a GRC function. It is the organisation's written record of what it knows could go wrong, who owns each of those things, and what it has decided to do. A well-kept register is the single most useful document a security team produces. Video: https://www.youtube.com/watch?v=8bX2xBJBW7A ## What this session covers - A risk statement should name the cause, the event and the consequence — not just a topic. 'Phishing' is not a risk; 'an employee is deceived into transferring funds to a fraudulent account, resulting in financial loss' is. - Record inherent and residual risk separately, so the value of your controls is visible. - Every entry needs a named owner — a person, not a department. - Record the treatment decision and its rationale, including for accepted risks. - Set review dates and honour them. An unreviewed register becomes fiction within a year. Registers decay in predictable ways. They grow until nobody reads them, entries are written so vaguely that no action is possible, and ownership sits with a team rather than a person so nothing moves. The discipline that prevents this is ruthless: fewer, clearer entries, each with a person's name against it and a date by which something will have changed. ## Go further with mentorship This session is part of our free twelve-week GRC series. If you want structured, mentor-led support to turn this into a job-ready skill set, the LSCS GRC Mentorship programme runs over six months with live sessions, real case studies and interview preparation. [See the GRC Mentorship programme](https://lscs.io/grc-mentorship-course-details/)